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Abstract. The security of quantum key distribution (QKD) relies on the Heisenberg 
uncertainty principle, with which legitimate users are able to estimate information 
leakage by monitoring the disturbance of the transmitted quantum signals. Normally, 
the disturbance is reflected as bit flip errors in the sifted key; thus, privacy 
amplification, which removes any leaked information from the key, generally depends 
on the bit error rate. Recently, a round-robin differential-phase-shift QKD protocol for 
which privacy amplification does not rely on the bit error rate [Nature 509, 475 (2014)] 
was proposed. The amount of leaked information can be bounded by the sender during 
the state-preparation stage and hence, is independent of the behaviour of the unreliable 
quantum channel. In our work, we apply the tagging technique to the protocol and 
present a tight bound on the key rate and employ a decoy-state method. The effects of 
background noise and misalignment are taken into account under practical conditions. 
Our simulation results show that the protocol can tolerate channel error rates close to 
50% within a typical experiment setting. That is, there is a negligible restriction on 
the error rate in practice. 
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1. Introduction 

Quantum cryptography enables secure information exchange between two remote 
parties, guaranteed by quantum physics. In particular, quantum key distribution (QKD) 
DEI offers a means of distributing keys with security that is information-theoretically 
provable based on the fundamental laws of quantum physics 0 m El E]. In a typical 
QKD protocol, a sender, Alice, transmits quantum signals through an untrusted channel 
to a receiver. Bob, who performs measurements and accumulates raw key data. Alice 
and Bob aim to share secure identical keys such that an adversary. Eve, cannot obtain 
information about the keys (up to a small failure probability). 

Due to experimental imperfections or eavesdropping, some of the shared sifted keys 
of Alice and Bob are not identical. Such differences are caused by events known as bit-flip 
errors. Alice and Bob can run an error correction procedure to make the keys identical. 
Besides this, owing to eavesdropping, parts of the shared keys may not be secure. The 
amount of information of the shared keys that is leaked to Eve can be quantihed by 
phase-flip errors [HE]. The Heisenberg uncertainty principle tells us that any attempts 
to eavesdrop on the quantum channel would inevitably cause disturbance in the quantum 
signals. Alice and Bob can thus quantify, or at least obtain an upper bound on, the 
phase error rate by monitoring the disturbance, and remove it by performing privacy 
amplihcation. Finally, the ratio of the distributed secure key per sifted key bit is given 
by 0, 

R= 1 - H{eut) - H{eph), (1.1) 

where Cbit and Cph are the bit and phase error rates, respectively, and H{x) = 
—X log 2 X — (1 — x) log 2 (l — x) is the binary Shannon entropy function. 

In conventional QKD protocols, there exists a fundamental limitation on the error 
rate. Intuitively, the more disturbance that the adversary introduces (say, indicated by 
a higher bit error rate), the more information she can obtain. For example, in the BB84 
protocol [T], due to its symmetries, the phase error rate can be estimated by the bit 
error rate Cph = ebit [5]. In the extreme case, where the bit flip error Cbit > 11%, the 
hnal key rate, R= 1 — 2if(ebit), drops to 0 according to Eq. fll.ll) . which means that no 
secure key can be achieved. Therefore, the above post-processing procedure works only 
for the case where the bit error rate is not larger than 11%. Higher error rate thresholds 
can be obtained by other postprocessing techniques [7], but upper bounds are generally 
believed to exist [8]. 

Surprisingly, this is not the case for all QKD protocols. In a recently proposed 
seminal QKD protocol known as the round-robin differential-phase-shift (RRDPS) [S], 
the phase error rate can be estimated with a different approach that does not depend 
on the bit error rate. Instead, the information Eve can acquire is directly bounded 
by the quantum source, regardless of how she interferes with the quantum signals. In 
this protocol, Alice encodes her information into the phase of a quantum signal that is 
in a superposition of L optical modes (say, L sequential pulses). Then, she sends the 
signal through a (unsafe) quantum channel to Bob, who randomly picks two of the L 



Practical round-robin differential-phase-shift quantum key distribution 


3 


modes and measures the phase difference between them to gain raw key data. Owing 
to the randomness of the measurement choices and the coherence of the signal, Eve can 
only acquire very limited information about the key. As the number of optical modes 
L increases, the information that Eve can obtain by eavesdropping decreases [5]. With 
a sufficiently long quantum signal (large L), the phase error rate can be reduced down 
to 0 and a secure key can be generated even if the bit error rate eut is close to 50%. 
Recently, many proof-of-principle experimental demonstrations of the RRDPS protocols 
have been presented UniElElE]. There are also several theoretical follow-ups that 
considered source flaws in the RRDPS protocol [TT] and its extensions to other QKD 
scenarios [laiis]. 

In practical QKD systems, weak coherent pulses are often used as photon sources. 
In conventional QKD protocols, such as BB84, the multi-photon component from a 
coherent state cannot lead to any secure keys as it is vulnerable against the photon 
number-splitting attack d- In the RRDPS protocol, when Alice splits the coherent 
state pulse into L pulses. Bob can generate a secure key even with multi-photon 
components. For an n-photon input state, the phase error rate can be upper-bounded 
by Cpjj < n/(L — 1) [9j. With a sufficiently large L, the n-photon state can still positively 
contribute to the final key rate, according to Eq. fll.ip . 

When the phase is randomized, a weak coherent state can be treated as a statistical 
mixture of Fock states, where the photon number follows a Poisson distribution. In 
the original security analysis [S], the phase error rate for a coherent state source is 
estimated by upper-bounding the photon number (up to a small failure probability). In 
this study, we apply the tagging technique, developed by Gottesman, Lo, Liitkenhaus, 
and Preskill (GLLP) [18], to assess the phase error rates for different photon number 
states separately. As a result, we derive a tighter secure key rate bound by reducing the 
cost in privacy amplification. In addition, we adopt the decoy-state method [IHIMIEI], 
which is widely used in regular QKD systems. 

Furthermore, we build a simulation model to analyse the performance of the RRDPS 
protocol under a practical scenario. We show that, in a practical setting, the maximum 
transmission distance cannot infinitely increase, even if the phase error rate, Cph, drops 
to zero via the increase of the number of optical mode L. Intuitively, this is due to 
the fact that the background rate, which is assumed to be a linear function of L, limits 
the maximum transmission distance. By simulation, we compare three security analysis 
methods: the one proposed by Sasaki, Yamamoto, and Koashi (SYK) [9], and our new 
analysis with and without decoy states. The results show the performance improvement 
by our new analysis methods. 

2. Review of the RRDPS protocol 

The RRDPS protocol is presented in figure [TJ Let us first consider the case wherein 
Alice uses a single-photon state source. Then the state |T)g that she prepares is in a 
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( 2 - 1 ) 

k=0 

where Sk G {0,1} is Alice’s encoded key information and \k) denotes the state of the 
photon appearing in the k-th mode. Alice’s L-bit key information, s G {0,1}^, is 
encoded in the phase of each mode, 0 or tt. In this study, we use temporal modes as an 
example of optical modes and hence Eq. (12.1 p forms an L-pulse sequence. In principle, 
Alice can use optical modes separated by other degrees of freedom, such as spectrum or 
angular momenta, where our results should be directly applied. 


1. Alice prepares a state in the (equal-amplitude) 
superposition of L (optical) modes and random¬ 
ly generates a random L-bit sequence, s = 
(so, Sl, . . . , SL-l). 

2. She applies phase modulation, (0, tt}, to each opti¬ 
cal mode according to s and obtains the state |4/)g. 
She sends the state to Bob. 

3. Bob splits the received signal with a 50/50 
beam splitter to obtain two L-pulse train- 
s, generates a random number r G {—L-\- 
1,... , —2, —1,1, 2,..., L — 1}, and shifts one of the 
L-pulse trains forward (r > 0) or backward (r < 0) 
by r pulses. 

4. Bob measures the interference between two L-pulse 
trains. If he obtains a detection on position i in the 
unshifted pulse train, corresponding to position j 
in the shifted pulse train, and 0 < j = i-\-r < L— 1, 
Bob records a raw key bit according to the relative 
phase SB = Si (B sj. Otherwise, Bob regards the 
transmission as a failure. 

5. Bob announces {i,j} so that Alice can obtain the 
sifted key, sa = Si © Sj. 


Figure 1: RRDPS protocol [9]. 

For general states, such as multi-photon states with extra dimensions, Alice can 
also encode the key information as follows. First, Alice prepares an L-pulse state I'k) 
and L ancillary qubits each in (|0) + |l))/\/2, where |0) and |1) are the eigenstates of 
the Z-basis. Then, she applies the L control operations U = |0) (0| ©/+ |1) (1| © (—I)” 
on each of the ancillaries as control and the L-pulse state |T) as the target, where h is 
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the photon number operator. When the control qubit is |1), all photons in the target 
light are shifted by a phase n. With this, Alice dually prepares the entangled state 


L-l 


\Sknk \ 1 ^^ 


k=0 

L-l 


E !»»>-= (- 1 )' 

k=0 

2'"''' E 11*). 

se{o,i}^ Vfc=o 


( 2 . 2 ) 


where |sfc)^ is the k-th ancillary qubit and fik is the photon number operator acting only 
on the fc-th pulse. After performing projection measurements on the ancillary qubits in 
the Z-basis, a specific measurement outcome, s = (sq, si,... sl-i), corresponds to the 
hnal output of 


l^)s 


^L-l 


IK-') 


^k'^k 


Ivh). 


yk=0 


(2.3) 


For instance, the state in Eq. fl2.ip corresponds to the case when |'K) is a single 
photon state. The measurement outcomes of the L ancillary qubits in the {|0), |1)} 
basis can be regarded as random numbers used to construct L bits s in (Fig. [1]). 

We suppose Alice measures the ancillary qubits after Bob announces {i,j). To 
obtain Sj © Sj, Alice performs a controlled-NOT gate (C-NOT) on the Ath and j-th 
ancillary qubits and measures the target in the Z basis. To define the phase error of the 
target qubit, we can measure it in the X basis. If the qubit is |+), no information is 
leaked to Eve. The phase error probability is denoted as the probability that the result 
is |—), which quantifies the leaked information of s* © Sj. 


3. Phase error estimation 

The schematic for the RRDPS presented in figure [1] is shown in figure [2^. To estimate 
how much sifted key information is leaked to Eve, one can consider an equivalent 
scenario, which is only applied in the security analysis, as shown in figure |2)3. In 
scenario b. Bob first generates a random number r G {—L + - - ,L — 1}. 

Then, he measures the photon of the received signal and obtains a detection in the ith 
pulse. Bob calculates j = i + r(mod L) with i and r, and announces the values of i and 
j. We consider Bob to be a black box with a quantum input and a classical output (z, j) 
where Eve’s interference of the quantum signal is considered. Since the input and output 
for the black boxes are identical under both scenarios, one can use scenario figure [2]b to 
estimate the phase error rate in scenario figure [2^. 

In scenario b, we imagine that Alice performs her measurement after Bob announces 
his outputs. To get the key bit = s* © Sj, Alice simply applies a C-NOT to the Ath 
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Figure 2: Two scenarios for the RRDPS protocol that are equivalent from 
Eve’s viewpoint, a. The key distribution procedures are described in hguredl 
Bob receives a quantum state and announces {i,j)- b. Bob measures the 
location of the photon in the received signal to obtain i, and dehnes j = i-\-r 
with randomly generated number r G {—L + 1, • • • , —1,1, • • • ,L — 1}. 


and j-th ancillary qubits, with the Tth qubit as the control and the j-th qubit as the 
target. After that, she measures the j-th qubit in the Z-basis and obtains a sifted key 
bit, sa- To estimate the phase error rate, Cph, one can simply measure the j-th qubit in 
the X-basis. If the j-th qubit is an eigenstate of the X-basis, the measurement outcome 
on the Z-basis is fully random that is, no information is leaked to Eve |6]. Hence, 
the phase error probability of measuring the j-th qubit is dehned by the probability of 
Ending it in the state |—). As the C-NOT operation will not affect the X-eigenvalues 
of the j-th qubit, which are randomly chosen uniformly from all qubits except the Ath 
one by Bob, the phase error rate can be estimated by the probability of Ending any 
except the Ath qubit in the |—) state. Notice that, in Eq. fl2.2jl . the probability of 
obtaining + or — is entirely determined by the number of photons contained in the jth 
pulse. The case of an odd (even) number of photons corresponds to outcome of |—) 
(resp. 1+)). Therefore, according to Eq. fl2.3p . the phase error rate can be estimated by 
the probability of Ending an odd number of photons in a pulse. 

According to Eq. fl2.3p . the phase error rate can be upper-bounded by the 
probability of Ending an odd number of photons appearing in a pulse. In the case 
where |\k) is an n-photon state, the maximum possible number of pulses wherein odd 
numbers of photons appear is n. In the SYK analysis [S] , the phase error rate is bounded 
by 

^Ph < (3.1) 


4. GLLP analysis 

In practice, a phase-randomised weak coherent state photon source is widely used in 
QKD systems. In the RRDPS protocol, Alice prepares a phase-randomised coherent 
state pulse with intensity Lp. According to the photon number channel model [20], the 
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(4.1) 


Then, following the procedures presented in hgure [H this strong pulse is split into L 
identical small pulses through beam splitters and becomes the initial state |T), which 
is encoded with key information according to Eq. fl2.3p . Note that the intensity of each 
small pulse, /i, is weak, but L/x can be large. 

For each n-photon term in Eq. fl4.1|) . the phase error rates can be estimated by 
Eq. fl3.ip . Denote the ratio of the key that needs to be sacrihced for privacy amplihcation 
by i7pA; by extending the GLLP security analysis [18], the amount of key loss in privacy 
amplification is given by 


n=0 


(4.2) 


where Ql^ = 17 i(L/i)"/n! is the overall gain and denotes the yield of the 

n-photon state. 

Then, the hnal key rate, similar to Eq. (ED. can be rewritten as 


L-R = Ql^.[1- i7(ebit) - 77 pa] , (4.3) 

where L ■ R is the hnal key bit per L-pulse train. Since these trains contain L pulses, 
the hnal key rate, R, should be normalised by L. In experiment, the overall gain Ql/a 
is an observable, while Yn is generally an unknown parameter that can be manipulated 
by Eve. In the following, we show three diherent approaches to the estimation of ifpA- 
Let us start with the original SYK analysis [9|, where the phase error rate is 
estimated by Eq. fl3.ip . One can set a threshold photon number nth, over which the 
phase error rate is bounded by 1/2. Since the phase error rate increases with the 
photon number n, one can consider the worst case scenario to be the case where the 
losses are all contributed from low photon numbers. That is, Y„ = 1 for n > nth- Also, 
for all the states with photon numbers less than nth, one has — %h ■ Thus, if pa in 
Eq. 04.211 can be upper bounded by 

QApiXPA < (qap - E + E (i). (4-4) 

where is bounded by Eq. 03. ip . In addition, one can optimise over the choice of nth 
to minimize iipA and hence maximize the hnal key rate R. 

With the tagging technique developed in the GLLP security analysis, we can 
estimate each privacy-amplihcation term in Eq. 04.2p separately. According to Eq. 03.ip . 
the phase error rate increases with the photon number n. In the worst case scenario, 
we assume all the losses come from the low-photon number states (with n < nth). 
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whereas all of the high-photon number states (with n > rith) pass through the channel 
transparently. Then, ifpA in Eq. 04.31) can be upper-bounded by 

qvj/pa < (ql, - Y. + E (4-5) 

\ n>nth ' / 

where e”* and are bounded by Eq. 03.11) . Here, the threshold photon number, 
rith, is the critical photon number such that the total, gain can be obtained by 
contributions from the terms with n > nth- In general, the value of nth calculated in 
Eq. 04.51) is different from the optimal nth from the SYK analysis, Eq. 04.4p . 

Although the yields Y„ in Eq. 04.21) cannot be directly measured by experiments, 
we can use the decoy-state method, by which all the values of Y„ can be accurately 
estimated with an infinite number of decoy states [20]. In the simulation, we simply use 
the case where Eve does not interfere with the yields, 

Y„ = l-(l-Yo)(l-hr, (4.6) 

where rj is the channel transmittance and Yq is the background count rate. That is, Yq 
denotes the count rate when Alice sends nothing (n = 0). 


5. Simulation model and result 


With the key rate formula for the RRDPS protocol given in Eq. 04.3p . we can compare 
the performances of the three different methods of estimating Hpa namely, Eqs. (lOD - 
04. 5 p and 04.Op . by means of modelling a practical system [22]. The simulation model is 
presented in Appendix D and the QKD experimental parameters are listed in Table [U 
In the simulation, we need to consider all the device imperfections such as misalignment, 
environmental noise and dark counts. 


Table 1: Parameters from a typical QKD system [23]. Here, rj^ is the 
detection efficiency, a is the channel loss, is the misalignment error rate, 
and yo is the background rate for each pulse. As there are L pulses, the total 
background rate should thus be Yq = 1 — (1 — Vo)^ ~ Lyo. We discuss the 
case where the total background rate is independent of L in the Discussion 
section. 


Experiment rj^ a 

GYS [23] 4.5% 3.3% 1.7 x lO-® 0.2 dB/km 


The performances of the RRDPS protocol with different analytical methods: SYK 
analysis, new analysis (no-decoy) and new analysis (decoy) are shown in figure [31 Here, 
we fix L at 32 and optimise y to obtain the maximum transmission distance. As one 
can see from figure [31 the improved analysis method enhances the performance, both in 
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Transmission distance [km] 

Figure 3: Final key rate for L = 32 using a practical QKD model, with 
parameters listed in Table [U 


terms of the key rate and the maximum transmission distance. The simulation result 
indicates that the decoy-state method is useful for the RRDPS protocol. 

In the conventional BB84 protocol, the decoy state is also utilized to increase the 
secure key generation rate and the transmission distance. Interestingly, the maximal 
secure distance of the asymptotic limit of the decoy state BB84 protocol (with inhnite 
decoy states) is also around 140 km [20] , with the same set of experimental parameters. 
In the simulation, we compare the BB84 and RRDPS protocols. The result shows that 
the RRDPS protocol tolerates the misalignment error better (see hgure n. Here, we 
compare the two protocols under two typical cases, for which transmission distances 
are, 50 km and 100 km, respectively. As shown in hgure H] the hnal key rates of the 
RRDPS protocol are higher than those in the BB84 protocol when the misalignment 
error rate are greater than 7%. In the 50 km case, the RRDPS protocol can tolerate 
a misalignment error rate of more than 40%; in the 100 km case, secure key can be 
generated even if the misalignment error rate is equal to 25% which is a hard upper 
bound of the BB84 protocol because of the intercept-and-resend attack Bi. 

We next briehy compare the RRDPS protocol with the measurement-device¬ 
independent QKD (MDIQKD) [211 [25] protocol. The MDIQKD protocol has been 
demonstrated over 200 km [261 [271 1211 [29] and in held test [30]. While the MDIQKD 
protocol enjoys the advantage of being secure against any detection loopholes, the 
RRDPS protocol is able to tolerate higher error rate. In the short distances, similar 
to the BB84 protocol, the RRDPS protocol should yield a higher key rate than the 
MDIQKD protocol. We expect two protocols should hnd suitable applications in 
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Misalignment error rate 

Figure 4: The optimized final key rate via the misalignment error rate. 


different practical scenarios. 


6. Discussion 


In the original security analysis [9], the signal going to Bob’s detection box is assumed to 
be single photon states. Also, the detectors used by Bob are assumed to be single-photon 
detectors (or photon number resolving detectors). In practice, these requirements are 
challenging with current technology. Instead, normally coherent state sources and 
threshold detectors are used. Thus, there is a gap between the security analysis and 
the implementation. A similar problem also exists for other QKD schemes [3T]. The 
solution there is to apply the squashing model [521 ESI ES] to Bob’s measurement. As a 
result, the signal Bob receives can be regarded as a qubit state in the security analysis. 
However, the squashing model cannot be directly applied here, since the single-photon 
state received by Bob is a qudit with a dimension of 2^. Thus, it is an interesting future 
project to work a squashing model for the general qudit case. 

The upper bound of the phase error with n-photons given in Eq. fl3.ip is only a 
rough estimation. An interesting future work is to find a tighter upper bound of the 
phase error rate and combine it with the GLLP tagging idea and the decoy-state method. 
In Appendix B we discuss an ideal case where the input n-photons are considered to 
be independent. We show that the phase error estimation can be improved such that 
it becomes 1/2 only in the limit of infinite photon numbers while the original phase 
error becomes 1/2 when n > L/2 -\- 1. Although such an ideal scenario may become 
vulnerable in practice, the result may still shed light on a better upper bound to the 
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phase error rate with multi-photons. 

In practice, the parameter L may not be chosen freely. When L increases, the 
(relative) phase maintenance may becomes challenging. That is, it is reasonable to 
assume that the misalignment parameter grows with increasing L. Supposing that we 
ignore this practical issue for the moment and optimise the parameter L, our simulation 
result shows that with a large L (optimal value around 10"^ for the two no-decoy cases), 
three curves in figure [3] can reach a maximal secure distance of 140 km. In the decoy 
state case, the result is very stable under different values of L. In fact, with L = 32, 
the performance is already very close to the optimal L case. From this perspective, the 
decoy-state method makes the RRDPS protocol easier to implement in practice. Note 
that a practical decoy-state method based on our result is recently published [35] . 

In the simulation, we assume that the total background count rate {Lyo) in an L- 
pulse block would linearly increase with L. One can also consider a scenario where the 
background noise, Yq, has a fixed value, independent of L. Under this assumption, as 
shown in Appendix C we prove that the maximum transmission distance can inhnitely 
increase, and that the optimal value of L linearly increases with the inverse of the 
channel transmittance, L oc l/y. This is not surprising, since the phase error rate 
approaches 0 as L increases, which allows the bit error rate (if it is independent of L) 
to grow arbitrarily close to 1/2. 

Furthermore, we show in Appendix D that the RRDPS protocol can tolerate the 
misalignment error, e^, up to 50%. Intuitively, this can be explained by the fact that 
the misalignment error (e^) is independent of L, and it is similar to the case where the 
background noise, Yq, is independent of L. Thus, we conjecture that the RRDPS is able 
to tolerate errors that are independent of L. 

In this study, we make use a phase-randomised coherent state as input. 
In experiments, the continually phase-randomisation requires the phase uniformly 
distributed from 0 to 27r, which is generally hard to implement. Instead, the discrete 
phase-randomisation can be applied to approximate exact phase-randomisation [33] . We 
leave such an extension to future research. 


Appendix A. Simulation model 

Here, we adopt a widely used simulation model for QKD [22|. Use Ly to denote the 
intensity of the source; rj to be the overall transmittance; T/ and e„ to be the yield (the 
probability of obtaining a successful detection) and the error rate, respectively, with n 
denoting the number of photons Alice sends. Without Eve’s interference, W and are 
given by 

y„ = 1 - (1 - F„)(i - 
e„y„ = e„y„ + ej(l - K„)ll - (1 - r,)”], 
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where the value of eo is equal to 0.5. Then the overall gain and QBER are given by 



= ro + (l-ho)(l-e-"^^), 


(A.2) 


= eolo + e,(l-yo)(l-e-’^^^). 


In simulation, we consider two different scenarios, an idealized one and a practical one. 
In the idealized case, we consider that the background noise, Iq = Vo, is independent of 
L. In the practical condition. Bob is required to obtain L detections and the background 
noise, Yq, becomes 1 — (1 — yo)^- 


We show in Appendix C that the maximal transmission distances of the RRDPS 


protocol behave differently under each of these two scenarios. In the idealized case, we 
show that the maximal transmission distance of the RRDPS protocol can be inhnite. In 
the practical case, we show that there exists a limit on the transmission distance (loss). 

Appendix B. Potential improvement for phase error rate estimation 

In this section, we consider phase error estimation with an n-photon state as a 
comparison to the estimation given in Eq. (HU. Here, we consider an ideal scenario 
that the n photons are independent. Note that the n photons are indeed independent 
when Alice prepares the state. Thus, the ideal scenario considered here only assumes 
that the quantum channel preserves this independency, for example, the beam splitting 
channel model. 

In such a case, we can consider that each photon independently appears in each 
pulse with an equal probability of p = 1/L. One can imagine that Alice first prepares 
an n-photon state and allows it to pass through many beam splitters to form an L-pulse 
sequence. We refer to Refs. [33 E] for the details of experimental implementations. 
When considering the case where Eve’s operation in the quantum channel does not 
change the photon-number statistics, the phase error rate estimation can be improved 
over the original one [H], 



(B.l) 


1 - (1 - 2pr 


2 


The key point here is that in the RRDPS protocol, the phase error rate of each pulse is 
determined by the preparation of quantum state, but not by Eve’s interaction. Thus, 
Alice and Bob do not need to accept the worst case scenario; instead, they can accurately 
derive the phase error rate in the state-preparation stage. This is the essential reason 
why the phase error rate in the RRDPS protocol is independent of the bit error rate. 
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Before we apply the new phase error estimation method to the QKD scheme, let 
ns hrst compare the SYK result in Eq. fl3.1|) with the new one in Eq. fIB.ip in hgure IBII 
One can see that the improved method does give a tighter bound on the phase error 
rate, for an n-photon state source. We expect that the key rate will be improved 
by employing the improved scheme, and this is conhrmed in later simulations. 



Figure Bl: Comparison between two different estimates of epj^ with L = 32 
and L = oo, in the case where Eve does not change the photon-number 
statistics. The SYK analysis method is given in Eq. fl3.ll) . The improved 
method is given in Eq. fIB.ll) . 


As shown in Fig. EH when the total photon number n of the L-pulse quantum signal 
increases beyond the value of L, the phase error rate, exponentially approaches to 
1/2 quickly, that is. 


-ph 


1 

2 


_ g-2n/L 


(B.2) 


where the ratio n/L can be interpreted as the mean photon number of each pulse. On 
the other hand, when n is much smaller than L, epj^ can be approximated as 
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It is not hard to see that the phase error decreases along with the mean photon nnmber 
of each pulse. In fact, in the entire regime of n and L, the phase error rate, 
mainly depends on the average photon number per pulse, n/L, as seen in Eq. flB.3p . In 
the meantime, we can see from figure IB2I that the new estimation method defined in 
Eq. fIB.lD is always better than the original SYK method defined in Eq. fl3.ip . Although 
the ideal case considered here is not the worst case scenario in practice, the improvement 
here indicates a better potential theoretical bound to the phase error estimation with 
multi-photon states. 



Figure B2: Comparison of two different estimates of 1/epj^ as a function Ljn. 
The SYK analysis method is given in Eq. fl3.1jl : the new method is given in 
Eq. fIB.lD . When the SYK analysis method is applied, the optimized value 
of the mean photon number is around 0.05. In this case, the value of Ljn is 
around 20. 


Appendix C. Mciximal transmission distance 

To calculate the maximal transmission loss, we consider the asymptotic case where the 
values of L and Lp, are very large. Since the total photon number of the state prepared 
by Alice follows a Poisson distribution, the photon number can be well-approximated 
by Lp. In this case, the cost of privacy amplihcation is close to a fixed value. A secure 
key can be generated in the case where the final key rate, i?, in Eq. fll.ljl is bigger than 
0 : 


1 - hf (Cbit) - hf (Cph) > 0. 


(C.l) 
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According to Eqs. and fIC.ljl . the threshold value of the bit-flip error rate, c, is 


c = H-^[l-H{e^^)] 


H 


-1 


1-H 


L/i 

L-1 


H-' [1-ffM] 


(C.2) 


Based on the simulation model in Eq. flA.2p . the bit-flip error rate is given by 


EL^iQifi _ _ (0.5 — erf)lo _ 

Ql, Yo + {l-Yo){l-e-^^f^y 


(C.3) 


which is a decreasing function of the overall transmittance r]. Since the bit error rate Cbit 
is upper-bounded by c, as given in Eq. flC.2p . the minimal overall transmittance in 
the case where Alice and Bob can communicate securely, can be calculated accordingly. 
Considering Cbit < c, Eq. flC.3p can be rewritten as 


1 - 




/ 0.5 - ed _ Yq 
\ C- Ed J 1-Yo' 


(C.4) 


Suppose that rj^nin is small, the term 1 — e can be well-approximated by 

Then, the minimized r/min can be approximated by 


Vmir 


T 

/i 


0-5 - Cd 

C- Cd 




(C.5) 


Notice that, the relationship between the transmission loss Tl (dB) and the overall 
transmittance rj is dehned by 

T/=-lOlogio??, (C.6) 

and the relationship between the transmission distance D (km) and the overall 
transmittance p is 

Tl 

= — =-50 logio (C.7) 

a 

where the channel loss a is 0.2 dB/km, as we adopted in Table [TJ In general, the 
transmission distance D increases as the overall transmittance rj decreases. 


Appendix C.l. L-independent Yq 

In an idealized case, where the background noise Yq = j/o is independent of L, secure 
transmission loss can be arbitrarily large with increasing L. That is, a secure key can be 
transmitted through arbitrarily large distance. Under this condition, Lr], only depends 
on p, as shown Eq. flC.5p . We can therefore optimise the parameter p to minimize 
which is found to be around 0.06 when using the experimental parameters in Table [U 
Under this optimal p, the overall transmittance is a linear function of 1/L, which can 
be inhnitely small if L is sufficiently large. 

We can also estimate the hnal key rate in the case that is very close to the maximal 
transmission distance. Eor instance, we consider the regime where the transmission 
distance is 0.1 km less than the maximal distance. In this regime, the optimal Lp 
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can be considered to have a fixed value. Combined with the optimal value of /i, the 
parameter Lrjfi is a fixed value. According to Eqs. flA.2p and flC.3l) . Cbit, and 

ELfiQcfi, determined by Lrjp,, are constants. The phase error rate Cph is determined 
by the parameter /i. Thus, we can see that the right-hand side of the Eq. 04.31) is a 
constant, and the final key rate i? is a linear function of 1/L (or rj). 


Appendix C.2. L-dependent Yq 

Under a practical condition, the total background rate Yq also depends on L. Suppose 
the state Alice that prepared is a vacuum, the probability that Bob still obtains 
a successful detection in each pulse is a nonzero value, yo, due to the background 
noise. Since there are L pulses, the total background contribution Yq is defined by 
the probability of a successful detection event with the vacuum input, which can be 
given by 1 - (1 - yo)^. 

From Eqs. flC.Sp and flC.9D . the overall transmittance is given by 


h ~ 7 

L \_y 


1 /0.5-erf 
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C-Cd 

1 /0.5-erf 

Lh 


1 - (1 - yoY 
(1 - yoV 


- 1 


2 / 0 , 
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where the second step can be derived by 

To 1 - (1 - 2/o)"' 


1-Un 


>(■ 


(1 - 2/o)^ 

1 .r 


2/0 

> {l + yo)^-l 

> Lyo. 


(C.8) 


(C.9) 


For any reasonable y, it can be concluded from Eq. fIC.Sp that the lower bound of 
the overall transmittance is a fixed value independent of L. Therefore, the transmission 
distance cannot reach infinity under this practical condition. Note that the bound of 
Eq. fIC.Sp is not tight. 


Appendix D. Tolerable bit error rate 

In the main context, we have shown that the RRDPS protocol can tolerate a bit-flip 
error rate Cbit close to 0.5 when the phase error rate Cph tends to 0. Here we give a 
simulation example to show that, under a practical condition, the RRDPS protocol can 
generate a secure key when Cbit = 0.4923. The result is shown in Table IDll One can 
see that the RRDPS protocol can tolerate the bit-flip error well. 
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Table Dl; RRDPS with a bit error rate close to 0.5. The experimental 
parameters are listed in Table [H except rj^ = 90% and Yq = 1 — {1 — yo)^ 
(without approximation). Here, we employ our new analysis method with 
decoy states. 


Distance 

L 

Lfi 

ed 

^bit 

R 

1 km 

220000 

0.77 

0.485 

0.4923 

2.265 X 10“^° 
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